The first time I heard discussion of this with no credible reasons I stocked up on many TP-Link layer 2 switches and several TP-Link access points. I have them all behind a firewall and I only allow the AP's to talk directly outbound when I choose to update the firmware. I have yet to see it attempt to dial home without my prompting it to and I have always been able to download firmware updates. The reason I stocked up is that TP-Link thus far have had the best result negotiating and maintaining proper speed and duplex on long cable runs. I have been quite happy with them. If A USA based company can make something as reliable I will switch to them assuming they have been brutally tested by many others with very custom setups. I have tested many AP's and switches over the years.

Am I the only person here that puts the AP behind a dedicated firewall with its own dedicated LAN/Subnet?

Anything with an sfp slot and a decent "optic" should blow tp-link's link stability out of the water. In about the same price range, have you tried mikrotik?

I've used tp-link routers, but installed and run openwrt.

I contemplated seeing if openwrt would run on them but was just lazy enough not to. I have enough spares I really should do that at some point and see if that has any change on the awesome negotiation reliability. That is a good idea.